COLLEGE POLICY POLICY TYPE: Administrative POLICY TITLE: Access to Student Records and Protection of Privacy Policy POLICY NO.: ADMIN-243 RESPONSIBILITY: President APPROVED BY: Durham College Leadership Team EFFECTIVE DATE: January 2014 REVISED: February 2016 REVIEW DATE: February 2018 1. Introduction The Access to Student Records and Protection of Privacy Policy establishes a policy for access to information and protection of privacy for student records at Durham College. Access to student records and information is governed by the Durham College Freedom of Information and Protection of Privacy Policy and Procedure and complies with the Freedom of Information and Protection of Privacy Act. Durham College shall collect, use and disclose and dispose of personal information related to its students in accordance with the following guidelines. 2. Purpose The purpose of the Student Records and Protection of Privacy Policy is to assist departments/schools in managing their student records and information effectively and efficiently in support of college activities. This policy will also assist departments/ schools to be in compliance with the Freedom of Information and Protection of Privacy Act (FIPPA). 3. Definitions Derived from the Freedom of Information and Protection of Privacy Act. 3.1. Record Any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes: 3.1.1. Correspondence, a memorandum, a book, a plan, a map, a drawing, a diagram, a pictorial or graphic work, a photograph, a film, a microfilm, a sound recording, a videotape, a machine readable record, any other documentary material, regardless of physical form or characteristics, and any copy thereof; and Page 1 of 9
3.1.2. Any record that requires equipment to read the information it holds such as audio, video, computer media records under the control of Durham College by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution. 3.2. Personal Information Any recorded information about an identifiable individual, including: 3.2.1. Information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual; 3.2.2. Information relating to the educational, medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved; 3.2.3. Any identifying number, symbol or other particular assigned to the individual; 3.2.4. The address, telephone number, fingerprints or blood type of the individual; 3.2.5. The personal opinions or views of the individual except where they relate to another individual; 3.2.6. Correspondence sent to the college by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence; 3.2.7. The views or opinions of another individual about the individual; and 3.2.8. The individual s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual. 3.3. Data Classifications 3.3.1 Confidential Electronic Information: that must be protected by law or industry regulation from unauthorized access, use or destruction including personally identifiable information (PII), financial records that reference individuals, health records and transcripts. 3.3.2 Internal Electronic Information: that is not protected by law or industry regulation from unauthorized access, use or destruction, but could cause harm to the institution or others if released to unauthorized individuals. 3.3.3 Public Electronic Information: that may be freely released to the public. Page 2 of 9
4. Policy statements This policy is designed to provide for the efficient and effective management of the college's records. 4.1. Collection and use of personal information 4.1.1. Personal information is collected under the authority the Ministry of Training, Colleges and Universities and will be used for educational, administrative and statistical purposes. 4.1.2. By applying for admission to Durham College and by enrolling in a program at Durham College, students consent to the collection of their personal information by Durham College for educational, administrative and statistical purposes. The information is needed to process their admission application and their enrolment and registration in academic programs; to record and track their academic progress; to provide the basis for awards and governmental funding and for related recordkeeping purposes. Students agree that all information and documentation submitted to Durham College in support of an application for admission, counselling and disability services, residence accommodation or financial award, or any petition or appeal, becomes the property of Durham College. 4.1.3. By applying for admission to Durham College and enrolling in a program, students consent to use of their personal information for communication of information relating to events, activities, services, fee payment reminders and other commercial messaging from the college. 4.1.4. An electronic record of students' achievements at Durham College is preserved permanently, but all other documentation contained in students' files may be destroyed in accordance with Durham College s records retention policies. 4.2. Change of name 4.2.1. Each student is required to provide, either on application for admission or in personal data required for registration, his or her full legal name. Any requests to change a name, by means of alteration or deletion, substitution or addition, must be accompanied by appropriate supporting documentation. Upon making application for graduation a student may be asked to provide proof of their name. 4.2.2. Changes to contact information can be done in person at the Office of the Registrar, or online through MyCampus. Page 3 of 9
4.3. Maintaining contact Information 4.3.1. An individual is considered an applicant to Durham College up until the point they make a fee payment to the institution. During this period, all official correspondence between Durham College and applicants is through the personal email account provided at the time of application or regular mail postal service. 4.3.2. After a payment has been made, all subsequent official correspondence between Durham College and enrolled students is done through the primary email account DC Mail or regular mail postal service. 4.3.3. Applicants and students must maintain current and up-to-date email address and permanent mailing address information on the records of Durham College in order to receive pertinent mailings. Students are responsible for ensuring their individual DCMail accounts are active and checked regularly. Changes to contact information can be made in person at the Office of Strategic Enrolment Services or online through MyCampus. 4.4. Access to confidential student records and disclosure of personal information 4.4.1. Public disclosure a) It is Durham College s policy to make the following information routinely available: Whether or not a student has received a particular academic award, honour or distinction whether from Durham College or an external third-party; and Diploma(s) or credential(s) that have been conferred by Durham College and the date(s) of conferral. b) Except as specified above, other information contained in the record will be disclosed with the student's written consent. This restriction applies to requests from all third-party inquirers, including parents, spouses and credit bureaus. 4.4.2. Student Access a) Students have the right to inspect their own official record, with the exception of evaluations and letters of reference supplied to Durham College with the understanding that they be kept confidential. b) Students have the right to request that erroneous information contained in their records be corrected and that recipients of any information found to be in error be advised of the correction. Page 4 of 9
c) Students wishing to inspect their record must make an appointment with the associate registrar, Student Service Operations. d) Students may not remove items from their Student Record file, but may request copies of items contained in their file. e) Upon written request to the Office of the Registrar, students whose fee account shows no outstanding balance may request to have an official transcript of their record of studies at Durham College sent to a thirdparty. f) Documents pertaining to a student's achievement at another institution, which may have been received by Durham College, will not be released or redirected. 4.4.3. Transcripts of academic record a) A student's signature or MyCampus login is required for the release of her or his own records. Durham College is not responsible for transcripts lost or delayed in the mail. b) In accordance with Durham College policy, transcripts and diplomas will not be released to students who have an outstanding account with Durham College. c) A fee will be charged for all official transcript requests. This fee is payable at the time the request is submitted. 4.4.4. Employee Access a) Employees of Durham College are permitted access to information contained in student records, if they need to access the information in order to perform their employment duties. The level of access must be related to their particular employment duties. b) Supervising managers and/or the Office of Strategic Enrolment Services have the authority to withdraw access to student records from any employee. c) Supervising managers are expected to review access rights for their employees at least once a semester. d) Student Medical, Dental, and Access and Support Centre records are to be accessed only by employees providing these support services directly to the student. Page 5 of 9
4.4.5. Disclosure to third-parties and student organizations a) All third-party organizations and student organizations are required to sign FIPPA-compliant confidentiality agreements with an authorized officer of Durham College before obtaining access to student personal information. Student information may only be used or disclosed in accordance with the provisions of the confidentiality agreements. b) All requests from student organizations must be approved by the Student Life department within the Division of Student Affairs. Listings of members will be made available upon written request to Student Life department and must be accompanied by a signature of the authorized officer of the Student Association and student organization. c) International Students are required to sign Citizenship and Immigration Canada (CIC) Application for Study Permit Made Outside of Canada Disclosure Form. d) Information may be shared with the following parties to facilitate fundamental activities: Other post-secondary institutions to verify any information provided as part of an application for admission; Other universities and colleges to share incidences of falsified documents or credentials, or share information regarding fraudulent applications for admission; Government offices to verify information regarding an application for admission and to support processes for government financial aid; Other universities and colleges with which Durham College maintains a collaborative program partnership; Service providers contracted by Durham College to support business processes. Government agencies federal and provincial, and law enforcement agencies relating to international student programs, study visas and other immigration matters, or for matters of national security or noncompliance with federal and provincial regulations. e) All requests from other third-party organizations must be approved by the Office of the Registrar. f) If someone other than the student wishes to pick up a document on behalf of a student (e.g. transcript, diploma), the student must provide that Page 6 of 9
person with a signed authorization. The third-party must provide the signed authorization as well as photo identification. 4.4.6. Legally mandated disclosures Specified records or portions thereof may be provided to persons or agencies pursuant to a court order in situations where the college is required to comply with the law, and as part of law enforcement investigations or proceedings. 4.4.7. Disclosure in emergency or compassionate situations a) On occasion, a personal emergency may require students to be contacted quickly. In emergency situations involving the health and safety of an individual, or in compassionate situations, the registrar or designate may, if considered to be in the best interest of the student, authorize the release of personal information about the student. Durham College will then inform the student of the disclosure. b) Students are urged to provide those who may need to be reached in an emergency with an up-to-date copy of their class timetable, specifying days, times and locations. In addition, students are required to routinely update their next of kin and emergency contact information. c) Changes to emergency contact information can be done in person at the Office of the Registrar, or online through MyCampus. 4.4.8. Notification of disclosure of personal information to Statistics Canada a) Statistics Canada is the national statistical agency. As such, Statistics Canada carries out hundreds of surveys each year on a wide range of matters, including education. b) It is essential to be able to follow students across time and institutions to understand, for example, the factors affecting enrolment demand at postsecondary institutions. The increased emphasis on accountability for public investment means that it is also important to understand outcomes. In order to carry out such studies, Statistics Canada asks all colleges and universities to provide data on students and graduates. Institutions collect and provide to Statistics Canada student identification information (student's name, student ID number, Social Insurance Number), student contact information (address and telephone number), student demographic characteristics, enrolment information, previous education and labour force activity. c) The Federal Statistics Act provides the legal authority for Statistics Canada to obtain access to personal information held by educational Page 7 of 9
institutions. The information may be used for statistical purposes only and the confidentiality provisions of the Statistics Act prevent the information from being released in any way that would identify a student. d) Students who do not wish to have their information used can ask Statistics Canada to remove their identifying information from the national database. On request by a student, Statistics Canada will delete an individual's contact information (name, address, or other personal identifiers) from the Postsecondary Student Information System (PSIS) database. To make such a request, please contact: By telephone: By mail: By email: Monday to Friday 8:30am to 4:30pm EST/DST 1-800-307-3382; or 1-613-951-7608 Institutional Surveys Section Centre for Education Statistics Statistics Canada Main Building, SC 2100-K Tunney s Pasture, Ottawa, Ontario K1A 0T6 PSIS-SIEP_contact@statcan.gc.ca Further details on the use of this information can be obtained from the Statistics Canada website. 4.4.9. Notification of disclosure of personal information to the MTCU. a) Durham College is required to report student-level enrolment-related data to the Ministry of Training, Colleges and Universities as a condition of its receipt of operating grant funding. The Ministry collects this enrolment data, which includes limited personal information such as Ontario Education Numbers, student characteristics and educational outcomes, in order to administer government post-secondary funding, policies and programs, including planning, evaluation and monitoring activities. b) Further information on the collection and use of student-level enrolment-related data can be obtained from the Ministry of Training Colleges and Universities website or by writing to: Director, Postsecondary Finance Branch, Postsecondary Education Division 7th Floor, Mowat Block 900 Bay Street Toronto, ON M7A 1L2. Page 8 of 9
5. Accessibility for Ontarians with Disabilities Act (AODA) considerations Durham College s commitment to accessibility and AODA standards has been considered in the development of this procedure and it adheres to the principles outlined in the AODA standards and Durham College Accessibility Policy (ADMIN-203). 6. Roles and responsibilities 6.1. The Office of the President is responsible for establishing the Student Records Policy on Access to Records and Protection of Privacy. 6.2. Each department is responsible for implementing the Student Records Policy on Access to Records and Protection of Privacy Management policy and procedures. 6.3. The Office of the Registrar is responsible for responding to inquiries from students regarding the Student Records Policy on Access to Records and Protection of Privacy. 7. Non-compliance implications Non-compliance could result in a breach of a student s privacy, resulting in harm such as identity theft, financial loss or reputational loss. Non-compliance could result in the inability to act in accordance to Freedom of Information and Protection of Privacy Act, which could result in fines against the college. It could also impact the college s ability to conduct some of its business and as a result harm the college financially or in reputation. 8. Communications plan A message will be posted on ICE alerting faculty and staff to this policy and the Records Management Portal on ICE. Policy to be reviewed as part of department meetings within two months of being approved. 9. Related policies, procedures and directives Durham College Records Information Management Policy ADMIN-242 Durham College Records and Information Management Procedure ADMIN 242.1 Durham College Document Imaging Procedure ADMIN-242.2 (pending approval) Durham College Freedom of Information and Protection of Privacy Policy ADMIN- 222 and Procedure ADMIN-222.1 Durham College Common Records Schedule CGSB 72.11-93 Microfilm and Document Images as Documentary Evidence Personal Information Protection and Electronic Documents Act Banner Document Management Suite User Guide Page 9 of 9